Librechat Librechat vulnerabilities
51 published vulnerabilities in Librechat Librechat. The most were published in 2026 (23), and 23 so far in 2026.
Librechat Librechat vulnerabilities by year
2024
2025
2026
Most exploited Librechat Librechat vulnerabilities
- CVE-2026-32625 LibreChat Exfiltrates Server Secrets via MCP Server URL Injection
- CVE-2024-11167 Improper Access Control in danny-avila/librechat
- CVE-2026-22252 LibreChat MCP Stdio Remote Command Execution
- CVE-2025-69222 LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions
- CVE-2024-41704 Path traversal in n/a
- CVE-2024-11170 Path Traversal in danny-avila/librechat
- CVE-2025-66450 LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload
- CVE-2025-66201 LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability
- CVE-2026-31943 LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP
- CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat
- CVE-2026-54030 LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow
- CVE-2025-41258 LibreChat RAG API Authentication Bypass
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.